added CORS filter, refactored OPTIONS filter